Splunk rules: 06

name: AdsiSearcher Account Discovery
id: de7fcadc-04f3-11ec-a241-acde48001122
version: 13
creation_date: '2021-08-25'
modification_date: '2026-05-13'
author: Teoderick Contreras, Mauricio Velazco, Splunk
status: production
type: TTP
description: The following analytic detects the use of the `[Adsisearcher]` type accelerator in PowerShell to query Active Directory for domain users. It leverages PowerShell Script Block Logging (EventCode=4104) to identify script blocks containing `[adsisearcher]`, `objectcategory=user`, and `.findAll()`. This activity is significant as it may indicate an attempt by adversaries or Red Teams to enumerate domain users for situational awareness and Active Directory discovery. If confirmed malicious, this could lead to further reconnaissance, privilege escalation, or lateral movement within the network.
data_source:
    - Powershell Script Block Logging 4104
search: |-
    `powershell` EventCode=4104 ScriptBlockText = "*[adsisearcher]*" ScriptBlockText = "*objectcategory=user*" ScriptBlockText = "*.findAll()*"
      | fillnull
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY dest signature signature_id
           user_id vendor_product EventID
           Guid Opcode Name
           Path ProcessID ScriptBlockId
           ScriptBlockText
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `adsisearcher_account_discovery_filter`
how_to_implement: The following Hunting analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging.
known_false_positives: Administrators or power users may use this command for troubleshooting.
references:
    - https://attack.mitre.org/techniques/T1087/002/
    - https://www.blackhillsinfosec.com/red-blue-purple/
    - https://devblogs.microsoft.com/scripting/use-the-powershell-adsisearcher-type-accelerator-to-search-active-directory/
finding:
    title: Powershell process have been used for user enumeration on $dest$
    entity:
        field: user_id
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 50
          message: Powershell process have been used for user enumeration on $dest$
analytic_story:
    - Industroyer2
    - Active Directory Discovery
    - CISA AA23-347A
    - Data Destruction
    - Scattered Lapsus$ Hunters
asset_type: Endpoint
mitre_attack_id:
    - T1087.002
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: ASL AWS IAM Delete Policy
id: 609ced68-d420-4ff7-8164-ae98b4b4018c
version: 9
creation_date: '2021-04-06'
modification_date: '2026-05-13'
author: Patrick Bareiss, Splunk
status: production
type: Hunting
description: The following analytic identifies when a policy is deleted in AWS. It leverages Amazon Security Lake logs to detect the DeletePolicy API operation. Monitoring policy deletions is crucial as it can indicate unauthorized attempts to weaken security controls. If confirmed malicious, this activity could allow an attacker to remove critical security policies, potentially leading to privilege escalation or unauthorized access to sensitive resources.
data_source:
    - ASL AWS CloudTrail
search: |-
    `amazon_security_lake` api.operation=DeletePolicy
      | fillnull
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY actor.user.uid api.operation api.service.name
           http_request.user_agent src_endpoint.ip actor.user.account.uid
           cloud.provider cloud.region
      | rename actor.user.uid as user api.operation as action api.service.name as dest http_request.user_agent as user_agent src_endpoint.ip as src actor.user.account.uid as vendor_account cloud.provider as vendor_product cloud.region as vendor_region
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `asl_aws_iam_delete_policy_filter`
how_to_implement: The detection is based on Amazon Security Lake events from Amazon Web Services (AWS), which is a centralized data lake that provides security-related data from AWS services. To use this detection, you must ingest CloudTrail logs from Amazon Security Lake into Splunk. To run this search, ensure that you ingest events using the latest version of Splunk Add-on for Amazon Web Services (https://splunkbase.splunk.com/app/1876) or the Federated Analytics App.
known_false_positives: This detection will require tuning to provide high fidelity detection capabilties. Tune based on src addresses (corporate offices, VPN terminations) or by groups of users. Not every user with AWS access should have permission to delete policies (least privilege). In addition, this may be saved seperately and tuned for failed or success attempts only.
references:
    - https://docs.aws.amazon.com/IAM/latest/APIReference/API_DeletePolicy.html
    - https://docs.aws.amazon.com/cli/latest/reference/iam/delete-policy.html
analytic_story:
    - AWS IAM Privilege Escalation
asset_type: AWS Account
mitre_attack_id:
    - T1098
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: access

name: AWS AMI Attribute Modification for Exfiltration
id: f2132d74-cf81-4c5e-8799-ab069e67dc9f
version: 11
creation_date: '2023-03-31'
modification_date: '2026-05-13'
author: Bhavin Patel, Splunk
status: production
type: TTP
description: The following analytic detects suspicious modifications to AWS AMI attributes, such as sharing an AMI with another AWS account or making it publicly accessible. It leverages AWS CloudTrail logs to identify these changes by monitoring specific API calls. This activity is significant because adversaries can exploit these modifications to exfiltrate sensitive data stored in AWS resources. If confirmed malicious, this could lead to unauthorized access and potential data breaches, compromising the confidentiality and integrity of organizational information.
data_source:
    - AWS CloudTrail ModifyImageAttribute
search: |-
    `cloudtrail` eventName=ModifyImageAttribute (requestParameters.launchPermission.add.items{}.userId = * OR requestParameters.launchPermission.add.items{}.group = all)
      | rename requestParameters.launchPermission.add.items{}.group as group_added
      | rename requestParameters.launchPermission.add.items{}.userId as accounts_added
      | eval ami_status=if(match(group_added,"all") ,"Public AMI", "Not Public")
      | rename user_name as user
      | stats count min(_time) as firstTime max(_time) as lastTime values(group_added) as group_added values(accounts_added) as accounts_added values(ami_status) as ami_status
        BY signature dest user
           user_agent src vendor_account
           vendor_region vendor_product
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `aws_ami_attribute_modification_for_exfiltration_filter`
how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs.
known_false_positives: It is possible that an AWS admin has legitimately shared a snapshot with others for  a specific purpose.
references:
    - https://labs.nettitude.com/blog/how-to-exfiltrate-aws-ec2-data/
    - https://stratus-red-team.cloud/attack-techniques/AWS/aws.exfiltration.ec2-share-ami/
    - https://hackingthe.cloud/aws/enumeration/loot_public_ebs_snapshots/
finding:
    title: AWS AMI from account $vendor_account$ is shared externally with $accounts_added$ from $src$ or AMI made is made Public.
    entity:
        field: user
        type: user
        score: 50
threat_objects:
    - field: src
      type: ip_address
analytic_story:
    - Suspicious Cloud Instance Activities
    - Data Exfiltration
asset_type: EC2 Snapshot
mitre_attack_id:
    - T1537
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: threat

name: Azure Runbook Webhook Created
id: e98944a9-92e4-443c-81b8-a322e33ce75a
version: 15
creation_date: '2022-08-23'
modification_date: '2026-05-13'
author: Mauricio Velazco, Brian Serocki, Splunk
status: production
type: TTP
description: The following analytic detects the creation of a new Automation Runbook Webhook within an Azure tenant. It leverages Azure Audit events, specifically the "Create or Update an Azure Automation webhook" operation, to identify this activity. This behavior is significant because Webhooks can trigger Automation Runbooks via unauthenticated URLs exposed to the Internet, posing a security risk. If confirmed malicious, an attacker could use this to execute code, create users, or maintain persistence within the environment, potentially leading to unauthorized access and control over Azure resources.
data_source:
    - Azure Audit Create or Update an Azure Automation webhook
search: |-
    `azure_audit` operationName.value="Microsoft.Automation/automationAccounts/webhooks/write" status.value=Succeeded
      | dedup object
      | rename claims.ipaddr as src_ip
      | rename caller as user
      | stats count min(_time) as firstTime max(_time) as lastTime values(dest) as dest
        BY object user, src_ip,
           resourceGroupName, object_path
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `azure_runbook_webhook_created_filter`
how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Audit events into your Splunk environment. Specifically, this analytic leverages the Azure Activity log category.
known_false_positives: Administrators may legitimately create Azure Runbook Webhooks. Filter as needed.
references:
    - https://docs.microsoft.com/en-us/azure/automation/overview
    - https://docs.microsoft.com/en-us/azure/automation/automation-runbook-types
    - https://docs.microsoft.com/en-us/azure/automation/automation-webhooks?tabs=portal
    - https://www.inversecos.com/2021/12/how-to-detect-malicious-azure.html
    - https://www.netspi.com/blog/technical/cloud-penetration-testing/maintaining-azure-persistence-via-automation-accounts/
    - https://microsoft.github.io/Azure-Threat-Research-Matrix/Persistence/AZT503/AZT503-3/
    - https://attack.mitre.org/techniques/T1078/004/
finding:
    title: A new Azure Runbook Webhook $object$ was created by $user$
    entity:
        field: user
        type: user
        score: 50
analytic_story:
    - Azure Active Directory Persistence
asset_type: Azure Tenant
mitre_attack_id:
    - T1078.004
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: cloud
security_domain: threat

name: Cisco Duo Bulk Policy Deletion
id: 983be012-e408-4cb0-b87f-6756bb5f7047
version: 5
creation_date: '2025-07-10'
modification_date: '2026-05-13'
author: Patrick Bareiss, Splunk
status: production
type: TTP
description: The following analytic detects instances where a Duo administrator performs a bulk deletion of more than three policies in a single action. It identifies this behavior by searching Duo activity logs for the policy_bulk_delete action, extracting the names of deleted policies, and counting them. If the count exceeds three, the event is flagged. This behavior is significant for a Security Operations Center (SOC) because mass deletion of security policies can indicate malicious activity, such as an attacker or rogue administrator attempting to weaken or disable security controls, potentially paving the way for further compromise. Detecting and investigating such actions promptly is critical, as the impact of this attack could include reduced security posture, increased risk of unauthorized access, and potential data breaches. Monitoring for bulk policy deletions helps ensure that any suspicious or unauthorized changes to security configurations are quickly identified and addressed to protect organizational assets and maintain compliance.
data_source:
    - Cisco Duo Administrator
search: '`cisco_duo_administrator` action=policy_bulk_delete | rename username as user | spath input=description | rex field=policies max_match=0 "(?<policy_name>[^:,]+):\s+" | eval policy_count=mvcount(policy_name) | where policy_count > 3 | stats count min(_time) as firstTime max(_time) as lastTime by action actionlabel description user admin_email policy_count | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `cisco_duo_bulk_policy_deletion_filter`'
how_to_implement: The analytic leverages Duo activity logs to be ingested using the Cisco Security Cloud App (https://splunkbase.splunk.com/app/7404).
known_false_positives: No false positives have been identified at this time.
references:
    - https://splunkbase.splunk.com/app/7404
finding:
    title: A user $user$ has deleted more than 3 policies
    entity:
        field: user
        type: user
        score: 50
analytic_story:
    - Cisco Duo Suspicious Activity
asset_type: Identity
mitre_attack_id:
    - T1556
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: application
security_domain: identity

name: Cisco NVM - Suspicious Network Connection to IP Lookup Service API
id: 568cb83e-d79e-4a23-85ec-6e1f6c30cb2f
version: 8
creation_date: '2025-07-01'
modification_date: '2026-07-14'
author: Nasreddine Bencherchali, Splunk, Janantha Marasinghe
status: production
type: Anomaly
description: |
    This analytic identifies non-browser processes reaching out to public IP lookup or geolocation services,
    such as `ipinfo.io`, `icanhazip.com`, `ip-api.com`, and others.
    These domains are commonly used by legitimate tools, but their usage outside of browsers may indicate
    network reconnaissance, virtual machine detection, or staging by malware.
    This activity is observed in post-exploitation frameworks, stealer malware, and advanced threat actor campaigns.
    The detection relies on Cisco Network Visibility Module (NVM) telemetry and excludes known browser
    processes to reduce noise.
data_source:
    - Cisco Network Visibility Module Flow Data
search: |
    `cisco_network_visibility_module_flowdata`
    dest_hostname IN (
            "*api.2ip.ua*", "*api.bigdatacloud.net*", "*api.ipify.org*", "*whatismyipaddress.com*",
            "*canireachthe.net*", "*checkip.amazonaws.com*", "*checkip.dyndns.org*", "*curlmyip.com*",
            "*db-ip.com*", "*edns.ip-api.com*", "*eth0.me*", "*freegeoip.app*", "*geoipy.com*", "*getip.pro*",
            "*icanhazip.com*", "*ident.me*", "*ifconfig.io*", "*ifconfig.me*", "*ip-api.com*", "*ip.360.cn*",
            "*ip.anysrc.net*", "*ip.taobao.com*", "*ip.tyk.nu*", "*ipaddressworld.com*", "*ipapi.co*",
            "*ipconfig.io*", "*ipecho.net*", "*ipinfo.io*", "*ipip.net*", "*iplocation.net*",
            "*ipof.in*", "*ipv6-test.com*", "*ipwho.is*", "*trackip.net*", "*inet-ip.info*",
            "*jsonip.com*", "*myexternalip.com*", "*seeip.org*",  "*wgetip.com*",
            "*whatismyip.akamai.com*", "*whois.pconline.com.cn*", "*wtfismyip.com*", "*ip.cn"
            )
    NOT process_name IN (
            "brave.exe", "chrome.exe", "firefox.exe", "iexplore.exe", "maxthon.exe",
            "MicrosoftEdge.exe", "msedge.exe", "msedgewebview2.exe", "opera.exe", "safari.exe",
            "seamonkey.exe", "vivaldi.exe", "whale.exe"
      )
    | stats count min(_time) as firstTime max(_time) as lastTime
            values(parent_process_arguments) as parent_process_arguments
            values(process_arguments) as process_arguments
            values(parent_process_hash) as parent_process_hash
            values(process_hash) as process_hash
            values(module_name_list) as module_name_list
            values(module_hash_list) as module_hash_list
            values(dest_port) as dest_port
            values(aliul) as additional_logged_in_users_list
            values(dest_hostname) as dest_hostname
            by src dest parent_process_path parent_process_integrity_level process_path process_name process_integrity_level process_id transport
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | table
      parent_process_integrity_level parent_process_path parent_process_arguments parent_process_hash
      process_integrity_level process_path process_name process_arguments process_hash process_id
      additional_logged_in_users_list module_name_list module_hash_list
      src dest_hostname dest dest_port transport firstTime lastTime
    | `cisco_nvm___suspicious_network_connection_to_ip_lookup_service_api_filter`
how_to_implement: |
    This search requires Network Visibility Module logs, which includes the flow data sourcetype.
    This search uses an input macro named `cisco_network_visibility_module_flowdata`.
    We strongly recommend that you specify your environment-specific configurations
    (index, source, sourcetype, etc.) for Cisco Network Visibility Module logs.
    Replace the macro definition with configurations for your Splunk environment.
    The search also uses a post-filter macro designed to filter out known false positives.
    The logs are to be ingested using the Splunk Add-on for Cisco Endpoint Security Analytics (CESA) (https://splunkbase.splunk.com/app/4221).
known_false_positives: |
    Internal scripts or agents performing network checks may query IP geolocation services.
    Tune by excluding known tools or adding internal allowlists for destination domains or process names and commandlines.
references:
    - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/net_connection_win_domain_external_ip_lookup.yml
    - https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-302a
intermediate_findings:
    entities:
        - field: src
          type: system
          score: 20
          message: The host $src$ made a network request to IP lookup service $dest_hostname$ using suspicious process $process_path$
threat_objects:
    - field: process_name
      type: process_name
analytic_story:
    - Cisco Network Visibility Module Analytics
    - Castle RAT
    - BlankGrabber Stealer
asset_type: Endpoint
mitre_attack_id:
    - T1590.005
    - T1016
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '31402.56381'
title: Defender Registry Values Modified
description: Adversaries may interact with the Windows Registry to disable security
  tools to avoid possible detection of their malware/tools and activities. They may
  interact directly with the registry via command line interpreters or they may abuse
  system utilities to achieve the same goals, such as SystemSettingsAdminFlows.exe.
  This use case detects commands for registry modifications targeting Windows Defender
  capabilities.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` ((TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) ("cmd.exe" OR "powershell.exe" OR "pwsh.exe")
  "Defender" (("DisableEnhancedNotifications" OR "RTP") "1") OR (("SubmitSamplesConsent"
  OR "SpynetReporting") "0") OR (("Set-ItemProperty" OR "sp " OR "ADD ") ("SOFTWARE\\Microsoft\\Windows
  Defender\\Reporting" OR "SOFTWARE\\Microsoft\\Windows Defender\\Spynet" OR "SOFTWARE\\Microsoft\\Windows
  Defender\\Real-Time Protection"))) OR ((TERM(EventCode=4657) OR "<EventID>4657<")
  ("SOFTWARE\\Microsoft\\Windows Defender\\Reporting" OR "SOFTWARE\\Microsoft\\Windows
  Defender\\Spynet" OR "SOFTWARE\\Microsoft\\Windows Defender\\Real-Time Protection"))
  | table _time, host, user, process, process_name, registry_* | bin span=1s | stats
  values(*) as * by _time, host '
techniques:
- defense-evasion:modify registry
- defense-evasion:impair defenses:disable or modify tools
technique_id:
- T1112
- T1562.001
data_category:
- Process command-line parameters
- Windows event logs
- Windows Registry
references:
- https://attack.mitre.org/techniques/T1562/001/
- https://attack.mitre.org/techniques/T1112/
- https://www.huntress.com/blog/lolbin-to-inc-ransomware

name: Detect Password Spray Attack Behavior On User
id: a7539705-7183-4a12-9b6a-b6eef645a6d7
version: 12
creation_date: '2023-11-11'
modification_date: '2026-05-13'
author: Steven Dick
status: production
type: TTP
description: The following analytic identifies any user failing to authenticate from 10 or more unique sources. This behavior could represent an adversary performing a Password Spraying attack to obtain initial access or elevate privileges. This logic can be used for real time security monitoring as well as threat hunting exercises. Environments can be very different depending on the organization. Test and customize this detections thresholds as needed
data_source:
    - Windows Event Log Security 4624
    - Windows Event Log Security 4625
search: |-
    | tstats `security_content_summariesonly` max(_time) as lastTime, min(_time) as firstTime, values(Authentication.user_category) as user_category values(Authentication.src_category) as src_category values(Authentication.app) as app count FROM datamodel=Authentication.Authentication
      BY Authentication.action Authentication.app Authentication.authentication_method
         Authentication.dest Authentication.signature Authentication.signature_id
         Authentication.src Authentication.user
    | `drop_dm_object_name("Authentication")`
    | eval user=case((match(upper(user),"[a-zA-Z0-9]{3}")),upper(user),true(),null), success=if(action="success",count,0), src=upper(src), success_src=if(action="success",src,null), failure=if(action="failure",count,0), failed_src=if(action="failure",src,null)
    | stats count min(firstTime) as firstTime max(lastTime) as lastTime values(app) as app values(src_category) as src_category values(success_src) as src values(failed_src) as failed_src dc(success_src) as success_dc dc(failed_src) as failed_dc dc(src) as src_dc, sum(failure) as failure, sum(success) as success
      BY user
    | fields - _time
    | where src_dc >= 10 AND .25 > (success/failure) AND failed_dc > success_dc
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `detect_password_spray_attack_behavior_on_user_filter`
how_to_implement: This detection requires ingesting authentication data to the appropriate accelerated datamodel. Recommend adjusting the search time window for this correlation to match the number of unique users (user_dc) in hours. i.e. 10 users over 10hrs
known_false_positives: Domain controllers, authentication chokepoints, and vulnerability scanners.
references:
    - https://attack.mitre.org/techniques/T1110/003/
    - https://www.microsoft.com/en-us/security/blog/2020/04/23/protecting-organization-password-spray-attacks/
    - https://github.com/MarkoH17/Spray365
finding:
    title: A total of $src_dc$ distinct sources attempted to access the account [$user$], $count$ times between [$firstTime$] and [$lastTime$]. $success$ successful logins detected.
    entity:
        field: user
        type: user
        score: 50
intermediate_findings:
    entities:
        - field: src
          type: system
          score: 50
          message: A total of $src_dc$ distinct sources attempted to access the account [$user$], $count$ times between [$firstTime$] and [$lastTime$]. $success$ successful logins detected.
analytic_story:
    - Compromised User Account
    - Crypto Stealer
asset_type: Account
mitre_attack_id:
    - T1110.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: access

name: Detect SNICat SNI Exfiltration
id: 82d06410-134c-11eb-adc1-0242ac120002
version: 10
creation_date: '2020-11-05'
modification_date: '2026-05-13'
author: Shannon Davis, Splunk
status: experimental
type: TTP
description: The following analytic identifies the use of SNICat tool commands within the TLS SNI field, indicating potential data exfiltration attempts. It leverages Zeek SSL data to detect specific SNICat commands such as LIST, LS, SIZE, LD, CB, EX, ALIVE, EXIT, WHERE, and finito in the server_name field. This activity is significant as SNICat is a known tool for covert data exfiltration using TLS. If confirmed malicious, this could allow attackers to exfiltrate sensitive data undetected, posing a severe threat to data confidentiality and integrity.
data_source: []
search: |-
    `zeek_ssl`
    | rex field=server_name "(?<snicat>(LIST|LS|SIZE|LD|CB|CD|EX|ALIVE|EXIT|WHERE|finito)-[A-Za-z0-9]{16}\.)"
    | stats count BY src_ip dest_ip server_name snicat
    | where count>0
    | table src_ip dest_ip server_name snicat
    | `detect_snicat_sni_exfiltration_filter`
how_to_implement: You must be ingesting Zeek SSL data into Splunk. Zeek data should also be getting ingested in JSON format.  We are detecting when any of the predefined SNICat commands are found within the server_name (SNI) field. These commands are LIST, LS, SIZE, LD, CB, EX, ALIVE, EXIT, WHERE, and finito.  You can go further once this has been detected, and run other searches to decode the SNI data to prove or disprove if any data exfiltration has taken place.
known_false_positives: No false positives have been identified at this time.
references:
    - https://www.mnemonic.io/resources/blog/introducing-snicat/
    - https://github.com/mnemonic-no/SNIcat
    - https://attack.mitre.org/techniques/T1041/
finding:
    title: Possible SNICat activity from $src_ip$
    entity:
        field: src_ip
        type: system
        score: 50
analytic_story:
    - Data Exfiltration
asset_type: Network
mitre_attack_id:
    - T1041
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: network
security_domain: network

name: Linux Account Manipulation Of SSH Config and Keys
id: 73a56508-1cf5-4df7-b8d9-5737fbdc27d2
version: 13
creation_date: '2022-04-12'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic detects the deletion of SSH keys on a Linux machine. It leverages filesystem event logs to identify when files within "/etc/ssh/*" or "~/.ssh/*" are deleted. This activity is significant because attackers may delete or modify SSH keys to evade security measures or as part of a destructive payload, similar to the AcidRain malware. If confirmed malicious, this behavior could lead to impaired security features, hindered forensic investigations, or further unauthorized access, necessitating immediate investigation to identify the responsible process and user.
data_source:
    - Sysmon for Linux EventID 11
search: |-
    | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem
      WHERE Filesystem.action=deleted
        AND
        Filesystem.file_path IN ("/etc/ssh/*", "~/.ssh/*")
      BY Filesystem.action Filesystem.dest Filesystem.file_access_time
         Filesystem.file_create_time Filesystem.file_hash Filesystem.file_modify_time
         Filesystem.file_name Filesystem.file_path Filesystem.file_acl
         Filesystem.file_size Filesystem.process_guid Filesystem.process_id
         Filesystem.user Filesystem.vendor_product
    | `drop_dm_object_name(Filesystem)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `linux_account_manipulation_of_ssh_config_and_keys_filter`
how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase.
known_false_positives: Administrator or network operator can execute this command. Please update the filter macros to remove false positives.
references:
    - https://www.sentinelone.com/labs/acidrain-a-modem-wiper-rains-down-on-europe/
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: SSH Config and keys are deleted on $dest$ by Process GUID - $process_guid$
analytic_story:
    - AcidRain
    - Hellcat Ransomware
asset_type: Endpoint
mitre_attack_id:
    - T1070.004
    - T1485
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Linux Auditd Edit Cron Table Parameter
id: f4bb7321-7e64-4d1e-b1aa-21f8b019a91f
version: 10
creation_date: '2024-08-12'
modification_date: '2026-05-13'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: The following analytic detects the suspicious editing of cron jobs in Linux using the crontab command-line parameter (-e). It identifies this activity by monitoring command-line executions involving 'crontab' and the edit parameter. This behavior is significant for a SOC as cron job manipulations can indicate unauthorized persistence attempts or scheduled malicious actions. If confirmed malicious, this activity could lead to system compromise, unauthorized access, or broader network compromise.
data_source:
    - Linux Auditd Syscall
search: |-
    `linux_auditd` type=SYSCALL syscall IN ("rename", "execve") (comm IN ("crontab") OR exe IN ("*/crontab")) success=yes AND NOT (UID IN("daemon"))
      | rename host as dest
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY comm exe syscall
           uid ppid pid
           dest
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `linux_auditd_edit_cron_table_parameter_filter`
how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names  to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed
known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives.
references:
    - https://attack.mitre.org/techniques/T1053/003/
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: A SYSCALL - [$comm$] event was executed on host - [$dest$] to edit the cron table.
analytic_story:
    - Scheduled Tasks
    - Linux Privilege Escalation
    - Linux Persistence Techniques
    - Linux Living Off The Land
    - Compromised Linux Host
asset_type: Endpoint
mitre_attack_id:
    - T1053.003
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '35191.61842'
title: MSI Installation via Appcert
description: An MSI file is a Microsoft Installer package used for installing software
  on Windows systems. Typically, .msi files are installed by msiexec.exe; AppCert.exe
  is a component of the Windows Application Compatibility Toolkit used primarily for
  application compatibility testing and can be used to install MSI files, but this
  is not normal usage for appcert. Threat actors may use appcert to install malicious
  MSI files in an attempt to evade detection. This use case detects appcert executions
  with commands to install an msi file. Living Off the Land Binary and Scripts (LOLBAS)
  (LOLBIN)
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
  (TERM(appcert) OR "appcert.exe") TERM(test) "-setupcommandline" | regex process="(?i)\stest\s.+\-setupcommandline"
  | table _time, host, user, process, parent_*, process_*, proxy_exec | bin span=1s
  | stats values(*) as * by _time, host '
techniques:
- defense-evasion:system binary proxy execution:msiexec
technique_id:
- T1218.007
data_category:
- Windows Sysmon
- Process command-line parameters
references:
- https://attack.mitre.org/techniques/T1127/
- https://attack.mitre.org/techniques/T1218/007/
- https://lolbas-project.github.io/lolbas/OtherMSBinaries/Appcert/

id: '18115.30466'
title: Non-MSIExec .msi Installation
description: 'This use case detects methods used to install .msi files without the
  use of msiexec.exe. Atomics T1218.007 Test #5 Atomics T1218.007 Test #6 Atomics
  T1218.007 Test #7 Atomics T1218.007 Test #8'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` (TERM(EventCode=4103) OR
  "<EventID>4103<" OR TERM(EventCode=4104) OR "<EventID>4104<") (TERM(install) OR
  TERM(/i)) ".msi" | regex process_name!="(?i)msiexec" | table _time, host, user parent_*,
  process, process_* | bin span=1s | stats values(*) as * by _time, host '
techniques:
- execution:command and scripting interpreter
technique_id: 
- T1059
data_category:
- PowerShell logs
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.007/T1218.007.md

name: PowerShell Start or Stop Service
id: 04207f8a-e08d-4ee6-be26-1e0c4488b04a
version: 12
creation_date: '2023-03-24'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: Anomaly
description: The following analytic identifies the use of PowerShell's Start-Service or Stop-Service cmdlets on an endpoint. It leverages PowerShell Script Block Logging to detect these commands. This activity is significant because attackers can manipulate services to disable or stop critical functions, causing system instability or disrupting business operations. If confirmed malicious, this behavior could allow attackers to disable security services, evade detection, or disrupt essential services, leading to potential system downtime and compromised security.
data_source:
    - Powershell Script Block Logging 4104
search: |-
    `powershell` EventCode=4104 ScriptBlockText IN ("*start-service*", "*stop-service*")
      | fillnull
      | stats count min(_time) as firstTime max(_time) as lastTime
        BY dest signature signature_id
           user_id vendor_product EventID
           Guid Opcode Name
           Path ProcessID ScriptBlockId
           ScriptBlockText
      | `security_content_ctime(firstTime)`
      | `security_content_ctime(lastTime)`
      | `powershell_start_or_stop_service_filter`
how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://help.splunk.com/en/security-offerings/splunk-user-behavior-analytics/get-data-in/5.4.1/add-other-data-to-splunk-uba/configure-powershell-logging-to-see-powershell-anomalies-in-splunk-uba.
known_false_positives: This behavior may be noisy, as these cmdlets are commonly used by system administrators or other legitimate users to manage services. Therefore, it is recommended not to enable this analytic as a direct finding Instead, it should be used as part of a broader set of security controls to detect and investigate potential threats.
references:
    - https://learn-powershell.net/2012/01/15/startingstopping-and-restarting-remote-services-with-powershell/
    - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/start-service?view=powershell-7.3
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: PowerShell was identified attempting to start or stop a service on $dest$.
analytic_story:
    - Scattered Lapsus$ Hunters
    - Active Directory Lateral Movement
asset_type: Endpoint
mitre_attack_id:
    - T1059.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Spoolsv Suspicious Process Access
id: 799b606e-da81-11eb-93f8-acde48001122
version: 13
creation_date: '2021-07-01'
modification_date: '2026-05-13'
author: Mauricio Velazco, Michael Haag, Teoderick Contreras, Splunk
status: production
type: TTP
description: The following analytic detects suspicious process access by spoolsv.exe, potentially indicating exploitation of the PrintNightmare vulnerability (CVE-2021-34527). It leverages Sysmon EventCode 10 to identify when spoolsv.exe accesses critical system files or processes like rundll32.exe with elevated privileges. This activity is significant as it may signal an attempt to gain unauthorized privilege escalation on a vulnerable machine. If confirmed malicious, an attacker could achieve elevated privileges, leading to further system compromise, persistent access, or unauthorized control over the affected environment.
data_source:
    - Sysmon EventID 10
search: '`sysmon` EventCode=10 SourceImage = "*\\spoolsv.exe" CallTrace = "*\\Windows\\system32\\spool\\DRIVERS\\x64\\*" TargetImage IN ("*\\rundll32.exe", "*\\spoolsv.exe") GrantedAccess = 0x1fffff | stats count min(_time) as firstTime max(_time) as lastTime by CallTrace EventID GrantedAccess Guid Opcode ProcessID SecurityID SourceImage SourceProcessGUID SourceProcessId TargetImage TargetProcessGUID TargetProcessId UserID dest granted_access parent_process_exec parent_process_guid parent_process_id parent_process_name parent_process_path process_exec process_guid process_id process_name process_path signature signature_id user_id vendor_product | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `spoolsv_suspicious_process_access_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting logs with process access event where SourceImage, TargetImage, GrantedAccess and CallTrace executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances of spoolsv.exe.
known_false_positives: No false positives have been identified at this time.
references:
    - https://github.com/cube0x0/impacket/commit/73b9466c17761384ece11e1028ec6689abad6818
    - https://www.truesec.com/hub/blog/fix-for-printnightmare-cve-2021-1675-exploit-to-keep-your-print-servers-running-while-a-patch-is-not-available
    - https://www.truesec.com/hub/blog/exploitable-critical-rce-vulnerability-allows-regular-users-to-fully-compromise-active-directory-printnightmare-cve-2021-1675
    - https://www.reddit.com/r/msp/comments/ob6y02/critical_vulnerability_printnightmare_exposes
finding:
    title: $SourceImage$ was GrantedAccess open access to $TargetImage$ on endpoint $dest$. This behavior is suspicious and related to PrintNightmare.
    entity:
        field: dest
        type: system
        score: 50
threat_objects:
    - field: ProcessID
      type: process
    - field: TargetImage
      type: process_name
analytic_story:
    - PrintNightmare CVE-2021-34527
    - Black Basta Ransomware
asset_type: Endpoint
cve:
    - CVE-2021-34527
mitre_attack_id:
    - T1068
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Suspicious mshta spawn
id: 4d33a488-5b5f-11eb-ae93-0242ac130002
version: 13
creation_date: '2021-01-20'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic detects the spawning of mshta.exe by wmiprvse.exe or svchost.exe. This behavior is identified using Endpoint Detection and Response (EDR) data, focusing on process creation events where the parent process is either wmiprvse.exe or svchost.exe. This activity is significant as it may indicate the use of a DCOM object to execute malicious scripts via mshta.exe, a common tactic in sophisticated attacks. If confirmed malicious, this could allow an attacker to execute arbitrary code, potentially leading to system compromise and further malicious activities.
data_source:
    - Sysmon EventID 1
    - Windows Event Log Security 4688
    - CrowdStrike ProcessRollup2
search: |-
    | tstats `security_content_summariesonly` count values(Processes.process_name) as process_name values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
      WHERE (
            Processes.parent_process_name=svchost.exe
            OR
            Processes.parent_process_name=wmiprvse.exe
        )
        AND `process_mshta`
      BY Processes.action Processes.dest Processes.original_file_name
         Processes.parent_process Processes.parent_process_exec Processes.parent_process_guid
         Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
         Processes.process Processes.process_exec Processes.process_guid
         Processes.process_hash Processes.process_id Processes.process_integrity_level
         Processes.process_name Processes.process_path Processes.user
         Processes.user_id Processes.vendor_product
    | `drop_dm_object_name(Processes)`
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `suspicious_mshta_spawn_filter`
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
known_false_positives: Although unlikely, some legitimate applications may exhibit this behavior, triggering a false positive.
references:
    - https://codewhitesec.blogspot.com/2018/07/lethalhta.html
    - https://github.com/redcanaryco/AtomicTestHarnesses
    - https://redcanary.com/blog/introducing-atomictestharnesses/
finding:
    title: mshta.exe spawned by wmiprvse.exe on $dest$
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - Suspicious MSHTA Activity
    - Living Off The Land
    - APT37 Rustonotto and FadeStealer
asset_type: Endpoint
mitre_attack_id:
    - T1218.005
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

id: '13454.19254'
title: System Owner_User Discovery - Windows
description: 'Adversaries may attempt to identify the primary user, currently logged
  in user, set of users that commonly uses a system, or whether a user is actively
  using the system. Adversaries may use the information during automated discovery
  to direct follow-on behaviors, including whether or not the adversary fully infects
  the target and/or attempts specific actions. This use case detects when reconnaissance
  commands specifically targeting discovery of system owners and users are executed
  in a short period of time. -- Threat Actor Association: Alloy Taurus/Gallium, APT28/Fancy
  Bear, FIN8 - Software Association: Play, Rhysida -- Atomics T1033 Test #1'
logic_format: Splunk
logic: ' `get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) ("whoami" OR "useraccount" OR "quser" OR "qwinsta.exe"
  ) | regex process="(?i)(whoami|useraccount|quser|qwinsta)" | table _time, host,
  user process, process_*, parent_process, parent_process_*, src_*, dest_* | bin span=60s
  | stats values(*) as * by _time, host, user | streamstats dc(process_name) as dc_process_name
  by _time, host | where dc_process_name>2 '
techniques:
- discovery:system owner/user discovery
technique_id: 
- T1033
data_category:
- Windows event logs
- Process command-line parameters
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1033/T1033.md#atomic-test-1---system-owneruser-discovery

id: '14952.22077'
title: Windows Process Copied from System Folder
description: 'Adversaries may attempt to manipulate features of their artifacts to
  make them appear legitimate or benign to users and/or security tools. Masquerading
  occurs when the name or location of an object, legitimate or malicious, is manipulated
  or abused for the sake of evading defenses and observation. This may include manipulating
  file metadata, tricking users into misidentifying the file type, and giving legitimate
  task or service names. Renaming abusable system utilities to evade security monitoring
  is also a form of masquerading. This use case detects copying of files from Windows
  system folders. Note: These events are only detected when a new process is created,
  or if PowerShell logging is enabled and used. -- Software Association: BATLoader,
  DarkGate, XWorm -- Atomics T1036 Test #1 Atomics T1546.008 Test #2'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
  "<EventID>4688<" OR Type=Process) (TERM(Copy-Item) OR TERM(copy) OR TERM(xcopy)
  OR TERM(cp) OR TERM(cpi) OR TERM(robocopy)) AND ("system32" OR "syswow64") | regex
  process="(?i)(copy-item|copy|xcopy|cp|cpi|robocopy)\s+.+(\x5c(system32|syswow64)\x5c)"
  | table _time, host, user, process, process_*, parent_process, parent_process_*,
  user | bin span=1s | stats values(*) as * by _time, host '
techniques:
- defense-evasion:masquerading
- defense-evasion:masquerading:rename system utilities
technique_id:
- T1036
- T1036.003
data_category:
- Windows event logs
- Process command-line parameters
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036/T1036.md

name: Windows Snake Malware Registry Modification wav OpenWithProgIds
id: 13cf8b79-805d-443c-bf52-f55bd7610dfd
version: 11
creation_date: '2023-05-11'
modification_date: '2026-05-13'
author: Michael Haag, Splunk
status: production
type: TTP
description: The following analytic identifies modifications to the registry path .wav\\OpenWithProgIds, associated with the Snake Malware campaign. It leverages data from the Endpoint.Registry datamodel to detect changes in this specific registry location. This activity is significant because Snake's WerFault.exe uses this registry path to decrypt an encrypted blob containing critical components like the AES key, IV, and paths for its kernel driver and loader. If confirmed malicious, this could allow the attacker to load and execute Snake's kernel driver, leading to potential system compromise and persistent access.
data_source:
    - Sysmon EventID 13
search: '| tstats `security_content_summariesonly` count values(Registry.registry_key_name) as registry_key_name values(Registry.registry_path) as registry_path min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path="*\\.wav\\OpenWithProgIds\\*" by Registry.action Registry.dest Registry.process_guid Registry.process_id Registry.registry_hive Registry.registry_path Registry.registry_key_name Registry.registry_value_data Registry.registry_value_name Registry.registry_value_type Registry.status Registry.user Registry.vendor_product | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` | `windows_snake_malware_registry_modification_wav_openwithprogids_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
known_false_positives: False positives may be present and will require tuning based on program Ids in large organizations.
references:
    - https://media.defense.gov/2023/May/09/2003218554/-1/-1/0/JOINT_CSA_HUNTING_RU_INTEL_SNAKE_MALWARE_20230509.PDF
finding:
    title: A registry modification related to Snake Malware has been identified on $dest$.
    entity:
        field: dest
        type: system
        score: 50
analytic_story:
    - Snake Malware
asset_type: Endpoint
atomic_guid:
    - 8318ad20-0488-4a64-98f4-72525a012f6b
mitre_attack_id:
    - T1112
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint

name: Windows Uncommon Remote Thread Creation In Browser Process
id: 634cce27-a3a6-4079-b0d6-3ced361a0aa9
version: 1
creation_date: '2026-06-29'
modification_date: '2026-06-29'
author: Teoderick Contreras, Nasreddine Bencherchali, Splunk
status: production
type: Anomaly
description: |-
    The following analytic identifies the creation of a remote thread by a process such as wermgr.exe or rundll32.exe into a browser process such as firefox.exe, chrome.exe, and others.
    These processes do not typically create remote threads, in browser processes.
    It leverages Sysmon EventID 8 to detect this behavior by monitoring SourceImage and TargetImage fields.
    This activity is significant because it is commonly associated with malware like Qakbot and IcedID, which injects malicious code into legitimate processes to steal information.
    If confirmed malicious, this activity could allow attackers to execute arbitrary code, escalate privileges, and exfiltrate sensitive data from the compromised host.
data_source:
    - Sysmon EventID 8
search: |-
    `sysmon`
    EventCode=8
    SourceImage IN (
        "*\\rundll32.exe",
        "*\\wermgr.exe"
    )
    TargetImage IN (
        "*\\Sputnik.exe",
        "*\\ChromePlus.exe",
        "*\\QIP Surf.exe",
        "*\\BlackHawk.exe",
        "*\\7Star.exe",
        "*\\Sleipnir5.exe",
        "*\\Citrio.exe",
        "*\\Chrome SxS.exe",
        "*\\Chrome.exe",
        "*\\Coowon.exe",
        "*\\CocCocBrowser.exe",
        "*\\Uran.exe",
        "*\\QQBrowser.exe",
        "*\\Orbitum.exe",
        "*\\Slimjet.exe",
        "*\\Iridium.exe",
        "*\\Vivaldi.exe",
        "*\\Chromium.exe",
        "*\\GhostBrowser.exe",
        "*\\CentBrowser.exe",
        "*\\Xvast.exe",
        "*\\Chedot.exe",
        "*\\SuperBird.exe",
        "*\\360Browser.exe",
        "*\\360Chrome.exe",
        "*\\dragon.exe",
        "*\\brave.exe",
        "*\\torch.exe",
        "*\\UCBrowser.exe",
        "*\\BliskBrowser.exe",
        "*\\Epic Privacy Browser.exe",
        "*\\nichrome.exe",
        "*\\AmigoBrowser.exe",
        "*\\KometaBrowser.exe",
        "*\\XpomBrowser.exe",
        "*\\msedge.exe",
        "*\\LiebaoBrowser.exe",
        "*\\AvastBrowser.exe",
        "*\\Kinza.exe",
        "*\\seamonkey.exe",
        "*\\icedragon.exe",
        "*\\cyberfox.exe",
        "*\\SlimBrowser.exe",
        "*\\palemoon.exe",
        "*\\opera.exe",
        "*\\yandex.exe",
        "*\\atom.exe",
        "*\\Chromodo.exe",
        "*\\360chrome.exe",
        "*\\360se.exe",
        "*\\Maxthon.exe",
        "*\\k-meleon.exe",
        "*\\SLBrowser.exe",
        "*\\Go!.exe",
        "*\\Secure Browser.exe",
        "*\\Elements Browser.exe",
        "*\\Mustang.exe",
        "*\\Suhba.exe",
        "*\\TorBro.exe",
        "*\\RockMelt.exe",
        "*\\Bromium.exe",
        "*\\Twinkstar.exe",
        "*\\iTop Private Browser.exe",
        "*\\CCleaner Browser.exe",
        "*\\AcWebBrowser.exe",
        "*\\CoolNovo.exe",
        "*\\spark.exe",
        "*\\iron.exe",
        "*\\Titan Browser.exe",
        "*\\AVG Browser.exe",
        "*\\UR Browser.exe",
        "*\\Flock.exe",
        "*\\CryptoTab Browser.exe",
        "*\\Sidekick.exe",
        "*\\SwingBrowser.exe",
        "*\\SalamWeb.exe",
        "*\\NetboxBrowser.exe",
        "*\\GarenaPlus.exe",
        "*\\InsomniacBrowser.exe",
        "*\\Viasat Browser.exe",
        "*\\whale.exe",
        "*\\falkon.exe",
        "*\\SogouExplorer.exe",
        "*\\firefox.exe",
        "*\\waterfox.exe",
        "*\\thunderbird.exe",
        "*\\basilisk.exe",
        "*\\BitTubeBrowser.exe"
    )
    | stats count min(_time) as firstTime
                  max(_time) as lastTime
                  values(NewThreadId) as "NewThreadId"
                  values(StartAddress) as "StartAddress"
      by dest signature_id signature
         SourceProcessGuid SourceProcessId SourceImage
         TargetProcessGuid TargetProcessId TargetImage
         StartModule StartFunction vendor_product
    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_uncommon_remote_thread_creation_in_browser_process_filter`
how_to_implement: |-
    To successfully implement this search, you need to be ingesting logs with the SourceImage, TargetImage, and EventCode executions from your endpoints related to create remote thread or injecting codes. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
known_false_positives: No false positives have been identified at this time.
references:
    - https://news.sophos.com/en-us/2022/03/10/qakbot-decoded/
    - https://www.trellix.com/en-us/about/newsroom/stories/research/demystifying-qbot-malware.html
    - https://www.joesandbox.com/analysis/380662/0/html
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: The process [$SourceImage$] created a remote thread into the browser process [$TargetImage$] in host $dest$.
threat_objects:
    - field: SourceImage
      type: process_name
    - field: TargetImage
      type: process_name
analytic_story:
    - Qakbot
    - IcedID
    - Living Off The Land
asset_type: Endpoint
mitre_attack_id:
    - T1055.001
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint